Link
Embed
Share
Beginning
This slide
Copy link URL
Copy link URL
Copy iframe embed code
Copy iframe embed code
Copy javascript embed code
Copy javascript embed code
Share
Tweet
Share
Tweet
Slide 1
Slide 1 text
Security is hard
Slide 2
Slide 2 text
André Arko @indirect
Slide 3
Slide 3 text
No content
Slide 4
Slide 4 text
No content
Slide 5
Slide 5 text
Security is hard
Slide 6
Slide 6 text
but we can’t go shopping
Slide 7
Slide 7 text
!
Slide 8
Slide 8 text
Ruby security releases
Slide 9
Slide 9 text
No content
Slide 10
Slide 10 text
No content
Slide 11
Slide 11 text
No content
Slide 12
Slide 12 text
that is a lot of releases
Slide 13
Slide 13 text
No content
Slide 14
Slide 14 text
Rails security releases
Slide 15
Slide 15 text
No content
Slide 16
Slide 16 text
that is a lot of more releases
Slide 17
Slide 17 text
wait what’s a CVE?
Slide 18
Slide 18 text
common vulnerabilities and exposures
Slide 19
Slide 19 text
numbering authorities
Slide 20
Slide 20 text
apple adobe cisco redhat etc.
Slide 21
Slide 21 text
cve.mitre.org nvd.nist.gov
Slide 22
Slide 22 text
minaswan security? vulnerabilities?
Slide 23
Slide 23 text
dhh + rails not as nice
Slide 24
Slide 24 text
dhh + rails but we can learn from them
Slide 25
Slide 25 text
so many gems for everything
Slide 26
Slide 26 text
so many chances for security issues
Slide 27
Slide 27 text
rubygems bundler json rexml rack
Slide 28
Slide 28 text
arel activerecord actionpack activesupport rdoc (rdoc?! yup.)
Slide 29
Slide 29 text
what should we do?
Slide 30
Slide 30 text
updating is a pain
Slide 31
Slide 31 text
updating blocks feature development
Slide 32
Slide 32 text
updating is insurance
Slide 33
Slide 33 text
a small cost to mitigate risk
Slide 34
Slide 34 text
without it failures are catastrophic
Slide 35
Slide 35 text
!
Slide 36
Slide 36 text
disclosure liability lawyers
Slide 37
Slide 37 text
updating is hard work !
Slide 38
Slide 38 text
but updating is worth it
Slide 39
Slide 39 text
update sleep well at night !
Slide 40
Slide 40 text
reporting security issues
Slide 41
Slide 41 text
responsible disclosure
Slide 42
Slide 42 text
the worst except for all the other options
Slide 43
Slide 43 text
the best yet because everyone ends up unhappy
Slide 44
Slide 44 text
!
Slide 45
Slide 45 text
but no one ends up screwed
Slide 46
Slide 46 text
disclosure companies hate it
Slide 47
Slide 47 text
responsible clever, triumphant hackers hate it
Slide 48
Slide 48 text
rewards! !
Slide 49
Slide 49 text
rewards! ! maybe everyone ends up happy?
Slide 50
Slide 50 text
google
Slide 51
Slide 51 text
No content
Slide 52
Slide 52 text
google severity scale $100 to $20,000
Slide 53
Slide 53 text
google paid over $130k so far this year
Slide 54
Slide 54 text
No content
Slide 55
Slide 55 text
facebook
Slide 56
Slide 56 text
No content
Slide 57
Slide 57 text
facebook $500 minimum no maximum
Slide 58
Slide 58 text
github
Slide 59
Slide 59 text
No content
Slide 60
Slide 60 text
github no stated reward $? maximum
Slide 61
Slide 61 text
engine yard
Slide 62
Slide 62 text
No content
Slide 63
Slide 63 text
engine yard no compensation $0 maximum
Slide 64
Slide 64 text
you anyway, back to
Slide 65
Slide 65 text
find a bug? what if you
Slide 66
Slide 66 text
questions ask yourself two
Slide 67
Slide 67 text
not mine? can I access something
Slide 68
Slide 68 text
other people? can I disable something for
Slide 69
Slide 69 text
disclose responsibly if the answer was yes
Slide 70
Slide 70 text
publicly contact an author before reporting
Slide 71
Slide 71 text
look for a security policy email in gemspec email on github
Slide 72
Slide 72 text
have empathy work together
Slide 73
Slide 73 text
if all else fails
Slide 74
Slide 74 text
fix it! if all else fails
Slide 75
Slide 75 text
finally, what about your gems?
Slide 76
Slide 76 text
your gems are security vulnerabilities waiting to happen
Slide 77
Slide 77 text
unless your code is perfect (and then I want to sell you this GREAT investment)
Slide 78
Slide 78 text
easy sympathetic discoverer
Slide 79
Slide 79 text
easy write fix, review fix release + announce
Slide 80
Slide 80 text
medium problem in the wild
Slide 81
Slide 81 text
medium announce if safe fix ASAP, test fix release + announce
Slide 82
Slide 82 text
hard researcher out for glory
Slide 83
Slide 83 text
hard respond ASAP set expectations update every 24-48h fix + release + thanks
Slide 84
Slide 84 text
make it as easy as possible
Slide 85
Slide 85 text
personally gemspec email github email
Slide 86
Slide 86 text
on a team security address PGP key disclosure policy
Slide 87
Slide 87 text
ecosystem mailing list for announcing security issues and releases
Slide 88
Slide 88 text
bit.ly/ruby-sec-ann
Slide 89
Slide 89 text
go shopping we can !"#$ %&'(
Slide 90
Slide 90 text
questions?